51–60 of 131 posts
The secret sharing across teams works which is good (LastPass's organization features are broken), but saving secrets is very slow right now.
https://enterprise.lastpass.com/enterprise-administration-ba...
Earlier quoted context omitted.
Secrets are stored on Mitro's servers. Presumably -- hopefully -- the passwords themselves are encrypted. Edit: Ah, yes: Mitro is distinctive amongst free/open source password managers in that it's architected around cloud storage. For security, the online password databases are encrypted with client-side keys derived from your master password. For availability, they are mirrored across three cloud storage providers.…
This I understand very well. So presumably they sent the email only after I sent them the first "blob of gibberish" telling them I added _at least_ one entry to my password database. Presumably they don't know if and when or how may entries I have. In this case they only noticed the first time I sent in my encrypted database.
I wonder if they have any plans for a phone app.
Where one could find a specification of the protocol used by Mitro?
We unfortunately don't have a great description of the protocol. The closest you can get is to look at the RPC proto spec: https://github.com/mitro-co/mitro/blob/master/mitro-core/jav...
I'm a 1password user, but I'll definitely be checking this out. Having recently switched to Windows, I'm liking it a lot less. To put it charitably, their Windows version is not quite as nice as the Mac and iOS releases. It's a sunk cost at this point, but owning 1password on 3 platforms is expensive . $70 for my laptop and desktop, and another $18 for my phone. But I bought into it because the Mac version is great a…
It actually is possible to create unique passwords for every website and remember them without inhuman displays of memory. To do so, there are two basic things you need to remember:
1) A unique base password 2) A simple hashing function
The input to the hashing function can be the company's name or website address (an overly simplified example - your hashing function could be the first two characters of the website's domain name). A unique password for any website could then be:
password = hash_function(domain) + base_password
A very simple way to create unique passwords for every website, inhuman memorization skills not required.
"Good security practices require us to use different passwords for most or all of the websites .... remembering all of your passwords requires an inhuman display of memory." It actually is possible to create unique passwords for every website and remember them without inhuman displays of memory. To do so, there are two basic things you need to remember: 1) A unique base password 2) A simple hashing function The input…
"Good security practices require us to use different passwords for most or all of the websites .... remembering all of your passwords requires an inhuman display of memory." It actually is possible to create unique passwords for every website and remember them without inhuman displays of memory. To do so, there are two basic things you need to remember: 1) A unique base password 2) A simple hashing function The input…
Except if your password gets compromised on two sites than hackers could identify the pattern and compromise every account you have.
Earlier quoted context omitted.
Except if your password gets compromised on two sites than hackers could identify the pattern and compromise every account you have.
Yes, but that is also the case if your password manager's password gets compromised.
not so with external websites — if you use the proposed strategy on two websites with poor security (something which is completely opaque to you), your passwords are compromised.